CVE-2026-41042
CRITICALApache Gravitino < 1.2.1 testConnection - Unauthenticated Remote Code Execution
Title source: manualDescription
Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
https://lists.apache.org/thread/vdh88wc6j5b38v65ncb111wbbnkf6bvm
Scores
CVSS v3
9.1
EPSS
0.0029
EPSS Percentile
20.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-20
Status
published
Products (1)
Apache Software Foundation/Apache Gravitino
< 1.2.1
Published
Jul 08, 2026
Tracked Since
Jul 08, 2026